The following command displays the formats of all audit event records. This command operates on records in the audit_class, audit_event, and audit_record_attr files.
# bsmrecord -a |
In this example, the format of the audit record with an ID of 6152 is displayed.
# bsmrecord -i 6152 # login: terminal login program /usr/sbin/login see login(1) event ID 6152 AUE_login class lo (0x00001000) header-token subject-token text-token error message exit-token # |